feat: add dependency information to conan lockfile parser

[Pro]

This MR adds proper dependency parsing from the conan lockfile.

The example output of the conan.lock file included in this MR is:

{
  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "serialNumber": "urn:uuid:d8a5a0b5-2263-4417-aa54-bae41d86bb13",
  "version": 1,
  "metadata": {
    "timestamp": "2023-09-14T13:33:39+02:00",
    "tools": [
      {
        "vendor": "anchore",
        "name": "syft",
        "version": "[not provided]"
      }
    ],
    "component": {
      "bom-ref": "7ea68ac679dc44fd",
      "type": "file",
      "name": "conan.lock",
      "version": "sha256:sha256:421e3aca902b6310bc89875e13c135843d574a0d01bc399c895fde46ecc16068"
    }
  },
  "components": [
    {
      "bom-ref": "pkg:conan/boost@1.75.0?package-id=aba68c636d6b683d",
      "type": "library",
      "name": "boost",
      "version": "1.75.0",
      "cpe": "cpe:2.3:a:boost:boost:1.75.0:*:*:*:*:*:*:*",
      "purl": "pkg:conan/boost@1.75.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "conan-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "c++"
        },
        {
          "name": "syft:package:metadataType",
          "value": "ConanLockMetadataType"
        },
        {
          "name": "syft:package:type",
          "value": "conan"
        },
        {
          "name": "syft:location:0:path",
          "value": "/conan.lock"
        }
      ]
    },
    {
      "bom-ref": "pkg:conan/bzip2@1.0.8?package-id=2a13ac92db8e1658",
      "type": "library",
      "name": "bzip2",
      "version": "1.0.8",
      "cpe": "cpe:2.3:a:bzip2:bzip2:1.0.8:*:*:*:*:*:*:*",
      "purl": "pkg:conan/bzip2@1.0.8",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "conan-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "c++"
        },
        {
          "name": "syft:package:metadataType",
          "value": "ConanLockMetadataType"
        },
        {
          "name": "syft:package:type",
          "value": "conan"
        },
        {
          "name": "syft:location:0:path",
          "value": "/conan.lock"
        }
      ]
    },
    {
      "bom-ref": "pkg:conan/libbacktrace@cci.20210118?package-id=11f1bbc08eaadac0",
      "type": "library",
      "name": "libbacktrace",
      "version": "cci.20210118",
      "cpe": "cpe:2.3:a:libbacktrace:libbacktrace:cci.20210118:*:*:*:*:*:*:*",
      "purl": "pkg:conan/libbacktrace@cci.20210118",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "conan-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "c++"
        },
        {
          "name": "syft:package:metadataType",
          "value": "ConanLockMetadataType"
        },
        {
          "name": "syft:package:type",
          "value": "conan"
        },
        {
          "name": "syft:location:0:path",
          "value": "/conan.lock"
        }
      ]
    },
    {
      "bom-ref": "pkg:conan/my_user/mfast@1.2.2?channel=my_channel&package-id=3117859c73631bd1",
      "type": "library",
      "name": "mfast",
      "version": "1.2.2",
      "cpe": "cpe:2.3:a:mfast:mfast:1.2.2:*:*:*:*:*:*:*",
      "purl": "pkg:conan/my_user/mfast@1.2.2?channel=my_channel",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "conan-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "c++"
        },
        {
          "name": "syft:package:metadataType",
          "value": "ConanLockMetadataType"
        },
        {
          "name": "syft:package:type",
          "value": "conan"
        },
        {
          "name": "syft:location:0:path",
          "value": "/conan.lock"
        }
      ]
    },
    {
      "bom-ref": "pkg:conan/tinyxml2@9.0.0?package-id=da460e25508a66a4",
      "type": "library",
      "name": "tinyxml2",
      "version": "9.0.0",
      "cpe": "cpe:2.3:a:tinyxml2:tinyxml2:9.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:conan/tinyxml2@9.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "conan-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "c++"
        },
        {
          "name": "syft:package:metadataType",
          "value": "ConanLockMetadataType"
        },
        {
          "name": "syft:package:type",
          "value": "conan"
        },
        {
          "name": "syft:location:0:path",
          "value": "/conan.lock"
        }
      ]
    },
    {
      "bom-ref": "pkg:conan/zlib@1.2.12?package-id=f23da074dc9de6d1",
      "type": "library",
      "name": "zlib",
      "version": "1.2.12",
      "cpe": "cpe:2.3:a:zlib:zlib:1.2.12:*:*:*:*:*:*:*",
      "purl": "pkg:conan/zlib@1.2.12",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "conan-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "c++"
        },
        {
          "name": "syft:package:metadataType",
          "value": "ConanLockMetadataType"
        },
        {
          "name": "syft:package:type",
          "value": "conan"
        },
        {
          "name": "syft:location:0:path",
          "value": "/conan.lock"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:conan/boost@1.75.0?package-id=aba68c636d6b683d",
      "dependsOn": [
        "pkg:conan/bzip2@1.0.8?package-id=2a13ac92db8e1658",
        "pkg:conan/libbacktrace@cci.20210118?package-id=11f1bbc08eaadac0",
        "pkg:conan/zlib@1.2.12?package-id=f23da074dc9de6d1"
      ]
    },
    {
      "ref": "pkg:conan/my_user/mfast@1.2.2?channel=my_channel&package-id=3117859c73631bd1",
      "dependsOn": [
        "pkg:conan/boost@1.75.0?package-id=aba68c636d6b683d",
        "pkg:conan/tinyxml2@9.0.0?package-id=da460e25508a66a4"
      ]
    }
  ]
}

[kzantow]

This looks like a great change @Pro! A couple notes:

This modifies the Syft JSON, so you'd need to update the JSON schema. Basically: bump the patch version (since this is just addition) major version (since this is a breaking schema change) in https://github.com/anchore/syft/blob/main/internal/constants.go#L6, run make generate-json-schema, and commit the changes.

And, you'll need to Sign-off your commits: https://github.com/anchore/syft/blob/main/CONTRIBUTING.md#sign-off-your-work

[Pro]

@kzantow can you please clarify the following for me:

The CycloneDX contains this metadata

"component": {
      "bom-ref": "7ea68ac679dc44fd",
      "type": "file",
      "name": "conan.lock",
      "version": "sha256:sha256:421e3aca902b6310bc89875e13c135843d574a0d01bc399c895fde46ecc16068"
    }

But if I Upload this bom to DependencyTrack, the Dependency Tree is not properly built.

Only if I change the metadata to the following, it is properly shown (i.e. bom-ref should point to a component in the list.

"component": {
      "bom-ref": "pkg:conan/my_user/mfast@1.2.2?channel=my_channel&package-id=3117859c73631bd1",
      "type": "library",
      "name": "mfast",
      "version": "1.2.2",
    }

But I can only set name and version via the command line args.

What would be the correct way to set this?

[kzantow]

@Pro are you referring to the metadata.component? This is the "source" you scanned: image, directory, file, etc.. However, this does not really have dependencies to the other components. Creating a graph in CycloneDX is much more limited than in SPDX -- in SPDX we add CONTAINS relationships for this, but the only option in CycloneDX is dependencies, which isn't accurate and we try very hard not to misuse the formats. I'm curious if you add additional dependency entries from the first entry to the other top-level components, does it look to work properly in DependencyTrack?

Also: I misspoke earlier and the schema change was breaking, so I went ahead and updated it on this PR (and also pushed a very small tweak I think helps readability just a bit)

[Pro]

@kzantow Thanks!
That makes it more clear. Will play around with SPDX then.

This MR is ready from my side.

[kzantow]

Thanks for the contribution @Pro !